Home › Development › SSH — policy-gated remote access

SSH — policy-gated remote access

Policy-gated, audited SSH for Linux and Windows hosts: roles, approvals, and an audit log.

TypeScript Local WindowsLinux

★ 762 stars Last pushed 2026-09-22 License: MIT

View repository → Website →

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (npm 2.11.0)

npx -y [email protected]

Or add to your MCP client config:

{
  "mcpServers": {
    "ssh-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "SSH_MCP_PASSWORD": "<YOUR_VALUE>",
        "SSH_MCP_KEY": "<YOUR_VALUE>",
        "SSH_MCP_PASSPHRASE": "<YOUR_VALUE>",
        "SSH_MCP_SUDO_PASSWORD": "<YOUR_VALUE>"
      }
    }
  }
}

SSH_MCP_PASSWORD secret — Password for the configured profile; a per-profile SSH_MCP_<PROFILE>_PASSWORD takes precedence. Credentials are never accepted as CLI arguments.
SSH_MCP_KEY — Path to the private key file to authenticate with — the path, not the key material. A per-profile SSH_MCP_<PROFILE>_KEY takes precedence.
SSH_MCP_PASSPHRASE secret — Passphrase for an encrypted private key.
SSH_MCP_SUDO_PASSWORD secret — Password the sudo tool escalates with, when the policy in force allows the privileged class.